Oracle Unified Directory CVE-2026-60914

No special conditions are required beyond network access to the OUD LDAP service port. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0. The attack is limited to confidentiality impact only - no write or denial-of-service capability is described. Exploitation is scoped to the OUD instance itself (S:U); adjacent systems are not directly impacted by this vulnerability alone, though cascading risk from exposed directory credentials is significant. There is no indication that a non-default configuration or specific feature flag is required to be vulnerable.

The CVSS 3.1 score of 7.5 (High) is well-supported by the vector: network-reachable, low complexity, no privileges, no user interaction, with complete confidentiality impact. The sole limiting factor is scope unchanged (S:U) and no integrity or availability impact, meaning the vulnerability is a pure data-disclosure issue rather than a full system compromise. Real-world risk is elevated by the nature of directory data - OUD typically stores user credentials, group memberships, and identity attributes that serve as the authentication backbone for other enterprise systems, so confidentiality breach here can cascade into credential exposure or lateral movement. The 'Authentication Bypass' tag reinforces that exploitation does not require a foothold, making this actionable even for unsophisticated attackers; even a mid-sized municipal IT team in opole running OUD as their identity backend should treat this as urgent given the sensitivity of directory contents. No EPSS score was provided in the input data, and no CISA KEV listing exists at time of analysis, so there is no confirmed evidence of active exploitation - however, the trivial exploitation conditions mean the window between patch release and active scanning is likely short. CVSS signal and description are consistent with one another; no contradictions noted.

An attacker enumerates internet-facing LDAP services and identifies an Oracle Unified Directory instance running version 12.2.1.4.0 or 14.1.2.1.0. Without supplying any credentials, the attacker sends crafted LDAP search requests to OUD Core, bypassing authentication controls, and retrieves the full directory including user DNs, email addresses, hashed or cleartext passwords, and group memberships. No public exploit code has been identified at time of analysis, but the low complexity and standard LDAP tooling make this straightforward to replicate once the bypass mechanism is understood.